Key distribution method and system and electronic equipment

Abstract

The invention provides a key distribution method and system and electronic equipment, and relates to the technical field of quantum communication. The method comprises the following steps: a central key management system generates a to-be-distributed key with a random length; obtaining a plurality of distribution key protection keys respectively corresponding to the key management systems of the plurality of areas, wherein the lengths of the plurality of distribution key protection keys are the same as the length of the to-be-distributed key; generating a plurality of key data according to the to-be-distributed key and the plurality of distributed key protection keys; respectively sending corresponding key data to key management systems of a plurality of areas, so that the management system of each area decrypts the corresponding key data according to the distribution key protection key to obtain a to-be-distributed key, and a post-quantum encryption algorithm is adopted to encrypt the to-be-distributed secret key, and the encrypted secret key is sent to the secret key receiving systems of the plurality of devices in each area. Different key distribution methods can be used in the domain and between the domains, and the key security is improved.

Description

Technical Field

[0001] The present application relates to the field of quantum communication technology, and more specifically, to a key distribution method, system and electronic device. Background Art

[0002] With the improvement of computer capabilities, it has posed a huge threat to the classical encryption system that relies on computational complexity. The quantum algorithm Shor's algorithm can crack difficult problems such as integer factorization and discrete logarithm. Asymmetric cryptographic algorithm mechanisms based on traditional RSA, ECC, SM2, etc. face great risks.

[0003] Quantum cryptography based on the Quantum Key Distribution (QKD) protocol is one of the most important practical applications of quantum communication at this stage. Traditional cryptography is a cryptographic system based on mathematics, while quantum cryptography is based on quantum mechanics. Its security is based on the uncertainty principle, quantum non-cloning, and quantum coherence and other physical properties. It has been proven to be absolutely safe. Therefore, quantum cryptography has attracted great attention from the academic community. Summary of the invention

[0004] The purpose of this application is to provide a key distribution method, system and electronic device to address the deficiencies in the above-mentioned prior art, so as to use different key distribution methods within and between domains to improve key security.

[0005] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0006] In a first aspect, an embodiment of the present application provides a key distribution method, which is applied to a central key management system, wherein the central key management system communicates with key management systems of multiple regions, and the key management system of each region communicates with key receiving systems of multiple devices in each region, and the method includes:

[0007] Generate a key with random length to be distributed;

[0008] Acquire multiple distribution key protection keys corresponding to the key management systems of the multiple regions respectively, wherein the multiple distribution key protection keys have the same length as the key to be distributed;

[0009] Generate multiple key data according to the key to be distributed and the multiple distribution key protection keys;

[0010] The corresponding key data are respectively sent to the key management systems of the multiple areas, so that the management system of each area decrypts the corresponding key data according to the distribution key protection key to obtain the key to be distributed, and uses a post-quantum encryption algorithm to encrypt the key to be distributed and then sends it to the key receiving system of multiple devices in each area.

[0011] Optionally, the generating a plurality of key data according to the key to be distributed and the plurality of distribution key protection keys comprises:

[0012] An exclusive OR operation is performed on the key to be distributed and the multiple distribution key protection keys to generate the multiple key data.

[0013] Optionally, the central key management system includes: a key distribution module and a first quantum key distribution module, and the obtaining of a plurality of distribution key protection keys respectively corresponding to the key management systems of the plurality of regions includes:

[0014] According to a quantum key distribution protocol, the first quantum key distribution module negotiates with the second quantum key distribution modules of the key management systems of the multiple regions respectively to determine a distribution key protection key with the same length as the key to be distributed;

[0015] Sending the distribution key protection key to the key distribution module through the first quantum key distribution module;

[0016] The step of generating a plurality of key data according to the key to be distributed and the plurality of distribution key protection keys comprises:

[0017] Generate the multiple key data according to the key to be distributed and the multiple distribution key protection keys by the key distribution module;

[0018] The sending corresponding key data to the key management systems of the multiple regions respectively includes:

[0019] The key distribution module sends corresponding key data to the key forwarding modules of the key management systems of the multiple areas respectively.

[0020] In a second aspect, an embodiment of the present application further provides a key distribution method, which is applied to a key management system in any area, wherein the key management system in any area communicates with a central key management system, and the key management system in any area also communicates with a key receiving system of multiple devices in the any area, and the method includes:

[0021] Receiving key data sent by the central key management system, wherein the key data is generated by the central key management system according to the key to be distributed and the distribution key protection key of the key management system of any region, and the distribution key protection key has the same length as the key to be distributed;

[0022] Decrypting the key data according to the distribution key protection key to obtain the key to be distributed;

[0023] Encrypting the key to be distributed using a preset post-quantum encryption algorithm to obtain an encrypted ciphertext;

[0024] The encrypted ciphertext is sent to the multiple devices respectively, so that the multiple devices decrypt the encrypted ciphertext respectively to obtain the key to be distributed.

[0025] Optionally, the adopting a preset post-quantum encryption algorithm to encrypt the key to be distributed to obtain an encrypted ciphertext includes:

[0026] Obtaining post-quantum public keys of the multiple devices;

[0027] The keys to be distributed are encrypted respectively according to the post-quantum public keys of the multiple devices to obtain multiple encrypted ciphertexts, and each device decrypts the encrypted ciphertexts according to the post-quantum private key corresponding to the post-quantum public key to obtain the keys to be distributed.

[0028] Optionally, encrypting the keys to be distributed according to the post-quantum public keys of the multiple devices respectively to obtain multiple encrypted ciphertexts includes:

[0029] Generate a symmetric key ciphertext of a symmetric key according to the post-quantum public key of each device;

[0030] Encrypting the key to be distributed according to the symmetric key of each device to obtain the encrypted ciphertext;

[0031] The sending corresponding encrypted ciphertexts to the multiple devices respectively includes:

[0032] The encrypted ciphertext and the symmetric key ciphertext are sent to the multiple devices respectively, so that each device decrypts the symmetric key ciphertext according to the post-quantum private key to obtain the symmetric key, and then decrypts the encrypted ciphertext according to the symmetric key to obtain the key to be distributed.

[0033] Optionally, the key management system of each region includes: a key forwarding module and a second quantum key distribution module. Before receiving the key data sent by the central key management system, the method further includes:

[0034] According to the quantum key distribution protocol, the second quantum key distribution module negotiates with the first quantum key distribution module of the central key management system to determine a distribution key protection key with the same length as the key to be distributed;

[0035] The distribution key protection key is sent to the key forwarding module through the second quantum key distribution module.

[0036] In a third aspect, an embodiment of the present application further provides a key distribution system, the key distribution system comprising: a central key management system, key management systems for multiple regions, and a key receiving system for multiple devices in each region;

[0037] The central key management system communicates with the key management systems of the multiple regions respectively to execute the key distribution method described in any one of the first aspects above and distribute keys to the key management systems of the multiple regions;

[0038] The key management system of each area communicates with the key receiving systems of multiple devices in each area respectively to execute the key distribution method described in any one of the second aspects above and distribute keys to the multiple devices.

[0039] Optionally, the central key management system includes: a key distribution module and a first quantum key distribution module, the key management system of each area includes: a key forwarding module and a second quantum key distribution module, and the key receiving system of each device includes: a key receiving and storage module;

[0040] The first quantum key distribution module and the second quantum key distribution module negotiate and distribute a key protection key through a quantum channel;

[0041] The key distribution module sends key data of the key to be distributed to the key forwarding module through a classic channel;

[0042] The key forwarding module decrypts the key data to obtain the key to be distributed, and sends the encrypted ciphertext corresponding to the key to be distributed to the key receiving and storage module;

[0043] The key receiving and storage module decrypts the encrypted ciphertext, obtains the key to be distributed and stores it persistently.

[0044] In a fourth aspect, an embodiment of the present application further provides a key distribution device, which is applied to a central key management system, wherein the central key management system communicates with key management systems of multiple regions, and the key management system of each region communicates with key receiving systems of multiple devices in each region, wherein the device includes:

[0045] A generation module, used to generate a key to be distributed with random length;

[0046] An acquisition module, used for acquiring a plurality of distribution key protection keys respectively corresponding to the key management systems of the plurality of regions, wherein the plurality of distribution key protection keys have the same length as the key to be distributed;

[0047] The generating module is further used to generate a plurality of key data according to the key to be distributed and the plurality of distribution key protection keys;

[0048] The first sending module is used to send corresponding key data to the key management systems of the multiple areas respectively, so that the management system of each area decrypts the corresponding key data according to the distribution key protection key to obtain the key to be distributed, and uses a post-quantum encryption algorithm to encrypt the key to be distributed and then sends it to the key receiving system of multiple devices in each area.

[0049] Optionally, the generating module is specifically used to perform XOR operation on the key to be distributed and the multiple distribution key protection keys respectively to generate the multiple key data.

[0050] Optionally, the central key management system includes: a key distribution module and a first quantum key distribution module, the acquisition module is used to negotiate with the second quantum key distribution modules of the key management systems of the multiple regions through the first quantum key distribution module according to the quantum key distribution protocol, to determine a distribution key protection key with the same length as the key to be distributed; and send the distribution key protection key to the key distribution module through the first quantum key distribution module;

[0051] The generating module is specifically configured to generate the plurality of key data according to the key to be distributed and the plurality of distribution key protection keys through the key distribution module;

[0052] The first sending module is specifically configured to send corresponding key data to key forwarding modules of the key management systems of the multiple regions respectively through the key distribution module.

[0053] In a fifth aspect, an embodiment of the present application further provides a key distribution device, which is applied to a key management system in any area, wherein the key management system in any area communicates with a central key management system, and the key management system in any area also communicates with a key receiving system of multiple devices in the any area, wherein the device includes:

[0054] A receiving module, used to receive key data sent by the central key management system, wherein the key data is generated by the central key management system according to the key to be distributed and the distribution key protection key of the key management system of any region, and the distribution key protection key has the same length as the key to be distributed;

[0055] A decryption module, used to decrypt the key data according to the distribution key protection key to obtain the key to be distributed;

[0056] An encryption module, used to encrypt the key to be distributed using a preset post-quantum encryption algorithm to obtain an encrypted ciphertext;

[0057] The second sending module is used to send the encrypted ciphertext to the multiple devices respectively, so that the multiple devices decrypt the encrypted ciphertext respectively to obtain the key to be distributed.

[0058] Optionally, the encryption module is specifically used to obtain the post-quantum public keys of the multiple devices; encrypt the keys to be distributed according to the post-quantum public keys of the multiple devices respectively to obtain multiple encrypted ciphertexts, and each device decrypts the encrypted ciphertext according to the post-quantum private key corresponding to the post-quantum public key to obtain the keys to be distributed.

[0059] Optionally, the encryption module is specifically used to generate a symmetric key ciphertext of a symmetric key according to the post-quantum public key of each device; encrypt the key to be distributed according to the symmetric key of each device to obtain the encrypted ciphertext;

[0060] The second sending module is specifically used to send the encrypted ciphertext and the symmetric key ciphertext to the multiple devices respectively, so that each device decrypts the symmetric key ciphertext according to the post-quantum private key to obtain the symmetric key, and then decrypts the encrypted ciphertext according to the symmetric key to obtain the key to be distributed.

[0061] Optionally, the key management system of each area includes: a key forwarding module and a second quantum key distribution module, and the device also includes:

[0062] A negotiation module is used to negotiate with the first quantum key distribution module of the central key management system through the second quantum key distribution module according to the quantum key distribution protocol to determine a distribution key protection key with the same length as the key to be distributed; and send the distribution key protection key to the key forwarding module through the second quantum key distribution module.

[0063] In the sixth aspect, an embodiment of the present application also provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the program instructions to perform the steps of the key distribution method as described in any one of the first aspect, or to perform the steps of the key distribution method as described in any one of the second aspect.

[0064] In the seventh aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the key distribution method as described in any one of the first aspect are executed, or the steps of the key distribution method as described in any one of the second aspect are executed.

[0065] The beneficial effects of this application are:

[0066] The key distribution method, system and electronic device provided by the present application, the central key management system uses the distribution key protection key of each area to encrypt the key to be distributed and then send it to the key management system of each area, the key management system in each area uses the post-quantum encryption algorithm to encrypt the key to be distributed and then send it to multiple devices in each area, different methods are used between and within areas to encrypt and distribute the key to be distributed, and the security of the key to be distributed is improved while ensuring the synchronization of the key to be distributed between and within areas. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0068] Figure 1 A schematic diagram of a key distribution system provided in an embodiment of the present application;

[0069] Figure 2 Schematic diagram of the key distribution method provided in the embodiment of the present application Figure 1 ;

[0070] Figure 3 Schematic diagram of the key distribution method provided in the embodiment of the present application Figure 2 ;

[0071] Figure 4 A key distribution interaction diagram provided for an embodiment of the present application;

[0072] Figure 5Schematic diagram of the key distribution method provided in the embodiment of the present application Figure 3 ;

[0073] Figure 6 Schematic diagram of the key distribution method provided in the embodiment of the present application Figure 4 ;

[0074] Figure 7 Schematic diagram of the key distribution method provided in the embodiment of the present application Figure 5 ;

[0075] Figure 8 A schematic diagram of the structure of the key distribution device provided in the embodiment of the present application Figure 1 ;

[0076] Fig. 9 A schematic diagram of the structure of the key distribution device provided in the embodiment of the present application Figure 2 ;

[0077] Fig.10 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0079] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0080] In addition, the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0081] It should be noted that, in the absence of conflict, the features in the embodiments of the present application may be combined with each other.

[0082] Before introducing the specific implementation of the key distribution method provided in the present application, in order to facilitate understanding of the solution of the present application, the key distribution system used in the present application is first described.

[0083] Figure 1 A schematic diagram of a key distribution system provided in an embodiment of the present application, such as Figure 1 As shown, the key distribution system includes: a central key management system, key management systems for multiple regions, and key receiving systems for multiple devices in each region.

[0084] The central key management system communicates with the key management systems of multiple regions respectively and distributes keys to the key management systems of multiple regions; the key management system of each region communicates with the key receiving systems of multiple devices in each region respectively and distributes keys to multiple devices.

[0085] Specifically, the central key management system initiates inter-regional synchronous key distribution and distributes keys to the key management systems of some or all of the multiple regions it manages. Each region includes multiple devices. After receiving the keys, the key management system of each region distributes the keys to multiple devices in the region, thereby realizing key synchronization from between regions to within regions.

[0086] Among them, the central key management system generates a key to be distributed with random length, and negotiates with the key management system of each area separately to distribute the key protection key, encrypts the key to be distributed with the distribution key protection key to obtain the key data, and sends the key data to the key management system of each area.

[0087] After receiving the key data, the key management system in each area decrypts the key data with the negotiated distribution key protection key to obtain the key to be distributed, and then uses the post-quantum encryption algorithm to encrypt the key to be distributed. The encrypted ciphertext is sent to the key receiving systems of multiple devices in each area. The key receiving systems of multiple devices decrypt the encrypted ciphertext to obtain the key to be distributed.

[0088] In one possible implementation, Figure 1 As shown, the central key management system includes: a key distribution module and a first quantum key distribution module, the key management system of each area includes: a key forwarding module and a second quantum key distribution module, and the key receiving system of each device includes: a key receiving and storage module.

[0089] The first quantum key distribution module and the second quantum key distribution module negotiate the distribution of key protection keys through quantum channels; the key distribution module sends key data of the key to be distributed to the key forwarding module through a classical channel; the key forwarding module decrypts according to the key data to obtain the key to be distributed, and sends the encrypted ciphertext corresponding to the key to be distributed to the key receiving and storage module; the key receiving and storage module decrypts the encrypted ciphertext to obtain the key to be distributed and stores it persistently.

[0090] Specifically, the key distribution module of the central key management system and the key forwarding module of the key management system of each region communicate through a classical channel constructed by a classical communication network such as Ethernet, the key distribution module can be a key distribution program in a classical communication terminal, and the key forwarding module can be a key forwarding program in a classical communication terminal. The first quantum key distribution module and the second quantum key distribution module communicate through a quantum channel constructed by a quantum communication network, and the first quantum key distribution module and the second quantum key distribution module can be QKD devices.

[0091] The first quantum key distribution module and the second quantum key distribution module negotiate a distribution key protection key, and the first quantum key distribution module sends the negotiated distribution key protection key to the key distribution module, which generates a key to be distributed with a random length, encrypts the key to be distributed with the distribution key protection key, and sends the encrypted key data to the key forwarding module of the key management system in each area.

[0092] The second quantum key distribution module sends the negotiated distribution key protection key to the key forwarding module. After the key forwarding module receives the key data sent by the key distribution module of the central key management system, it uses the distribution key protection key to decrypt the key data to obtain the key to be distributed.

[0093] Then the key forwarding module uses the post-quantum cryptography (PQC) algorithm to encrypt the key to be distributed, and sends the encrypted ciphertext to the key receiving and storage modules of multiple devices in the area. The key receiving and storage module decrypts the encrypted ciphertext to obtain the key to be distributed for persistent storage.

[0094] Based on the above key distribution system, the key distribution method of the central key management system applied in the above key distribution system is described below in combination with an embodiment.

[0095] Figure 2 Schematic diagram of the key distribution method provided in the embodiment of the present application Figure 1 ,like Figure 2 As shown, the method may include:

[0096] S101. Generate a key to be distributed with random length.

[0097] In this embodiment, the central key management system uses a quantum random algorithm to generate quantum random number bytes, and uses the quantum random number bytes as the key to be distributed, that is, key. The length of the quantum random number bytes is k.

[0098] S102: Acquire multiple distribution key protection keys corresponding to the key management systems of multiple regions respectively, where the lengths of the multiple distribution key protection keys are the same as the length of the key to be distributed.

[0099] In this embodiment, the central key management system can select the region where cross-domain key distribution is required, communicate with the key management system of the selected region through the quantum channel constructed by the quantum communication network, and obtain the distribution key protection key ks1, ..., ks of each region based on the quantum key distribution protocol. n , distribution key protection key ks1,…,ks n The length of is consistent with the length of the key to be distributed.

[0100] S103. Generate multiple key data according to the key to be distributed and multiple distribution key protection keys.

[0101] In this embodiment, the central key management system uses the distribution key protection keys ks1, ..., ks n The keys to be distributed are encrypted separately to generate key data corresponding to each area.

[0102] In some embodiments, the process of generating multiple key data according to the key to be distributed and multiple distribution key protection keys in S103 may include:

[0103] An exclusive OR operation is performed on the key to be distributed and multiple distribution key protection keys respectively to generate multiple key data.

[0104] In this embodiment, the central key management system distributes key protection keys ks1, ..., ks n Perform XOR operation with the key to be distributed respectively to obtain the key data corresponding to each area.

[0105] S104. Send corresponding key data to the key management systems of multiple areas respectively, so that the management system of each area decrypts the corresponding key data according to the distribution key protection key to obtain the key to be distributed, and uses the post-quantum encryption algorithm to encrypt the key to be distributed and then send it to the key receiving system of multiple devices in each area.

[0106] In this embodiment, after the distribution key is encrypted by the distribution key protection key, it is no longer necessary to use the quantum key distribution protocol to generate the key. Therefore, it is no longer necessary to generate the encrypted key data through the quantum signal. The central key management system communicates with the key management system of the selected area through a classical communication network such as a classical channel constructed by Ethernet, and sends the key data encrypted by the distribution key protection key of each area to the key management system of the corresponding area.

[0107] The key management system that receives the encrypted key data uses its own distribution key protection key to decrypt the key data to obtain the key to be distributed.

[0108] The key management system of each area uses the PQC algorithm to encrypt the key to be distributed, and sends the encrypted ciphertext to the key receiving system of multiple devices in each area. After the key receiving systems of multiple devices receive the encrypted ciphertext, they decrypt the encrypted ciphertext to obtain the key to be distributed.

[0109] In the key distribution method provided in the above embodiment, the central key management system uses the distribution key protection key of each area to encrypt the key to be distributed and then sends it to the key management systems of each area. The key management system in each area uses the post-quantum encryption algorithm to encrypt the key to be distributed and then sends it to multiple devices in each area. Different methods are used to encrypt and distribute the key to be distributed between areas and within areas. While ensuring that the key to be distributed is synchronized between areas and within areas, the security of the key to be distributed is improved.

[0110] In one possible implementation, Figure 3 Schematic diagram of the key distribution method provided in the embodiment of the present application Figure 2 ,like Figure 3 As shown, the process of obtaining multiple distribution key protection keys corresponding to the key management systems of multiple regions respectively through the quantum communication network in S102 may include:

[0111] S121. According to the quantum key distribution protocol, the first quantum key distribution module negotiates with the second quantum key distribution modules of the key management systems of the multiple regions respectively to determine a distribution key protection key having the same length as the key to be distributed.

[0112] S122. Send a distribution key protection key to the key distribution module through the first quantum key distribution module.

[0113] The process of generating multiple key data according to the key to be distributed and multiple distribution key protection keys in S103 may include:

[0114] S131. Generate multiple key data according to the key to be distributed and multiple distribution key protection keys through the key distribution module.

[0115] The process of sending corresponding key data to the key management systems of multiple regions in S104 may include:

[0116] S141. Send corresponding key data to key forwarding modules of key management systems of multiple regions through a key distribution module.

[0117] For example, Figure 4 The key distribution interaction diagram provided in the embodiment of the present application is as follows: Figure 4 As shown, the first quantum key distribution module QKD in the central key management system and the second quantum key distribution module QKD in the key management system of each region negotiate the distribution key protection key ks1, ..., ks with a length of k on the quantum signal using the quantum key distribution protocol. n .

[0118] The negotiation process is specifically as follows: the first quantum key distribution module selects a preparation basis to adjust the randomly generated quantum bit sequence to obtain a quantum and sends it to the second quantum key distribution module; the second quantum key distribution module randomly selects a measurement basis to measure the quantum and obtains the measurement result and demodulates it to obtain a quantum bit sequence; after that, the first quantum key distribution module and the second quantum key distribution module compare the basis vectors for consistency and retain the quantum bit data with the same basis vector as the distribution key protection key.

[0119] After the negotiation is completed, the first quantum key distribution module will negotiate with the second quantum key distribution module in each area to obtain the distribution key protection key ks1, ..., ks n The key distribution module uses the distribution key of each area to protect the key ks1, ..., ks n Perform XOR operations on the generated keys to be distributed respectively to obtain the key data corresponding to each area, and send the key data of each area to the key forwarding module in the key management system of each area through the classic channel.

[0120] The second quantum key distribution module in each region also sends the negotiated distribution key protection key ks1, ..., ks n The key is sent to the corresponding key forwarding module. After receiving the key data, the key forwarding module uses its own distribution key protection key to decrypt the key data to obtain the key to be distributed.

[0121] The key distribution method provided in the above embodiment uses the QKD algorithm to encrypt and distribute keys between the central key management system and the key management systems of each region, ensuring that long-distance cross-regional transmission uses more secure quantum communication, and uses the PQC algorithm to encrypt and distribute keys between the key management systems of each region and the devices in the region, which can effectively resist quantum computing attacks and provide security capabilities in the post-quantum era. The combination of the two algorithms greatly improves key security. And because the construction costs of QKD equipment and quantum networks are relatively high, quantum communication networks are used for long-distance cross-regional transmission, and classical networks are used within the region, which can balance the construction costs of the system while being compatible with security.

[0122] The following describes a key distribution method of a key management system applied to any area of ​​the above-mentioned key distribution system in conjunction with an embodiment.

[0123] Figure 5 Schematic diagram of the key distribution method provided in the embodiment of the present application Figure 3 ,like Figure 5 As shown, the method may include:

[0124] S201. Receive key data sent by the central key management system. The key data is generated by the central key management system according to the key to be distributed and the distribution key protection key of the key management system of any region. The distribution key protection key has the same length as the key to be distributed.

[0125] S202. Decrypt the key data according to the distribution key protection key to obtain the key to be distributed.

[0126] S203: Use a preset post-quantum encryption algorithm to encrypt the key to be distributed to obtain an encrypted ciphertext.

[0127] S204: Send the encrypted ciphertext to multiple devices respectively, so that the multiple devices decrypt the encrypted ciphertext respectively to obtain the key to be distributed.

[0128] In this embodiment, the key management system of the area selected by the central key management system negotiates with the central key management system to determine its own distribution key protection key, and then receives the key data encrypted by the central key management system using the distribution key protection key to treat the distribution key. The key distribution process of the central key management system is as described in S101-S104 above, which will not be elaborated in this embodiment.

[0129] According to its own distribution key protection key determined through negotiation with the central key management system, the key data is decrypted to obtain the key to be distributed, the key to be distributed is encrypted using the PQC encryption algorithm, and the encrypted ciphertext is sent to the key receiving system of multiple devices in each area. After the key receiving systems of multiple devices receive the encrypted ciphertext, they decrypt the encrypted ciphertext to obtain the key to be distributed.

[0130] In one possible implementation, Figure 6 Schematic diagram of the key distribution method provided in the embodiment of the present application Figure 4 ,like Figure 6 As shown, the process of using a preset post-quantum encryption algorithm to encrypt the key to be distributed in S203 to obtain an encrypted ciphertext may include:

[0131] S301. Obtain post-quantum public keys of multiple devices.

[0132] S302. Encrypt the keys to be distributed according to the post-quantum public keys of multiple devices respectively to obtain multiple encrypted ciphertexts. Each device decrypts the encrypted ciphertext according to the post-quantum private key corresponding to the post-quantum public key to obtain the keys to be distributed.

[0133] In this embodiment, if Figure 4 As shown, taking area 1 as an example, area 1 includes multiple devices HSM 1,1 , …, HSM 1,n , multiple device HSM 1,1 , …, HSM 1,n The PQC algorithm is used to generate the respective PQC public and private key pairs. The key management system KSM1 in area 1 obtains multiple device HSMs. 1,1 , …, HSM 1,n The PQC public keys pk1,…,pk n ; The key management system KSM1 in region 1 uses multiple devices HSM 1,1 , …, HSM 1,n The PQC public keys pk1,…,pk n Encrypt the key to be distributed separately to obtain multiple device HSMs 1,1 , …, HSM 1,n The corresponding encrypted ciphertext is sent to multiple devices HSM 1,1 , …, HSM 1,n The corresponding encrypted ciphertext is sent to the corresponding device, multiple device HSM 1,1 , …, HSM 1,n Use your own PQC private key to decrypt the received encrypted ciphertext to obtain the key to be distributed.

[0134] Furthermore, Figure 7 Schematic diagram of the key distribution method provided in the embodiment of the present application Figure 5 ,like Figure 7 As shown, the process of encrypting the distribution keys according to the post-quantum public keys of the multiple devices in S302 to obtain multiple encrypted ciphertexts may include:

[0135] S401. Generate a symmetric key ciphertext of a symmetric key according to the post-quantum public key of each device.

[0136] S402: Encrypt the key to be distributed according to the symmetric key of each device to obtain an encrypted ciphertext.

[0137] The above-mentioned process of S204, sending the encrypted ciphertext to multiple devices respectively, may include:

[0138] S403. Send the encrypted ciphertext and the symmetric key ciphertext to multiple devices respectively, so that each device decrypts the symmetric key ciphertext according to the post-quantum private key to obtain the symmetric key, and then decrypts the encrypted ciphertext according to the symmetric key to obtain the key to be distributed.

[0139] In this embodiment, the symmetric key generated by the symmetric key algorithm is encrypted according to the PQC public key of each device to obtain the symmetric key ciphertext of each device, and the key to be distributed is encrypted using the symmetric key to obtain the encrypted ciphertext, and the symmetric key ciphertext of each device and the encrypted ciphertext are sent to each device together, and each device uses its own PQC private key to decrypt the symmetric key ciphertext to obtain the symmetric key, and the encrypted ciphertext is decrypted using the symmetric key to obtain the key to be distributed. After each device decrypts and obtains the key to be distributed, it stores the key to be distributed persistently.

[0140] In the key distribution method provided in the above embodiment, the central key management system uses the distribution key protection key of each area to encrypt the key to be distributed and then sends it to the key management systems of each area. The key management system in each area uses the post-quantum encryption algorithm to encrypt the key to be distributed and then sends it to multiple devices in each area. Different methods are used to encrypt and distribute the key to be distributed between areas and within areas. While ensuring that the key to be distributed is synchronized between areas and within areas, the security of the key to be distributed is improved.

[0141] In a possible implementation, before receiving the key data sent by the central key management system in S201, the method may further include:

[0142] According to the quantum key distribution protocol, the second quantum key distribution module negotiates with the first quantum key distribution module of the central key management system to determine a distribution key protection key with the same length as the key to be distributed; and the distribution key protection key is sent to the key forwarding module through the second quantum key distribution module.

[0143] In this embodiment, the process of the central key management system and the key management system of each region negotiating and distributing the key protection key is as described in S121-S122, S131, and S141 above, and will not be repeated in this embodiment.

[0144] After the key forwarding module receives the key data sent by the key sending module, it decrypts the key data according to the distribution key protection key to obtain the key to be distributed, and encrypts the key to be distributed according to the PQC public key of the device in the area, and sends the encrypted ciphertext to the key receiving and storage module of the device.

[0145] The key distribution method provided in the above embodiment uses the QKD algorithm to encrypt and distribute keys between the central key management system and the key management systems of each region, ensuring that long-distance cross-regional transmission uses more secure quantum communication, and uses the PQC algorithm to encrypt and distribute keys between the key management systems of each region and the devices in the region, which can effectively resist quantum computing attacks and provide security capabilities in the post-quantum era. The combination of the two algorithms greatly improves key security. And because the construction costs of QKD equipment and quantum networks are relatively high, quantum communication networks are used for long-distance cross-regional transmission, and classical networks are used within the region, which can balance the construction costs of the system while being compatible with security.

[0146] Based on the above method embodiments, the embodiments of the present application also provide a key distribution device, which is applied to a central key management system. The central key management system communicates with key management systems of multiple regions, and the key management system of each region communicates with key receiving systems of multiple devices in each region. Figure 8 A schematic diagram of the structure of the key distribution device provided in the embodiment of the present application Figure 1 ,like Figure 8 As shown, the device may include:

[0147] A generation module 501, used to generate a key to be distributed with random length;

[0148] An acquisition module 502 is used to acquire a plurality of distribution key protection keys corresponding to the key management systems of the plurality of regions respectively, wherein the plurality of distribution key protection keys have the same length as the key to be distributed;

[0149] The generating module 501 is further used to generate a plurality of key data according to the key to be distributed and the plurality of distribution key protection keys;

[0150] The first sending module 503 is used to send corresponding key data to the key management systems of multiple areas respectively, so that the management system of each area decrypts the corresponding key data according to the distribution key protection key to obtain the key to be distributed, and uses the post-quantum encryption algorithm to encrypt the key to be distributed and then send it to the key receiving system of multiple devices in each area.

[0151] Optionally, the generating module 501 is specifically used to perform XOR operation on the key to be distributed and multiple distribution key protection keys respectively to generate multiple key data.

[0152] Optionally, the central key management system includes: a key distribution module and a first quantum key distribution module, an acquisition module 502, configured to negotiate with second quantum key distribution modules of key management systems of multiple regions through the first quantum key distribution module according to a quantum key distribution protocol, to determine a distribution key protection key with the same length as the key to be distributed; and to send the distribution key protection key to the key distribution module through the first quantum key distribution module;

[0153] A generating module 501 is specifically used to generate a plurality of key data according to a key to be distributed and a plurality of distribution key protection keys through a key distribution module;

[0154] The first sending module 503 is specifically configured to send corresponding key data to key forwarding modules of key management systems of multiple regions respectively through the key distribution module.

[0155] Based on the above method embodiments, the embodiments of the present application also provide a key distribution device, which is applied to the key management system of any area. The key management system of any area communicates with the central key management system, and the key management system of any area also communicates with the key receiving systems of multiple devices in any area. Fig. 9 A schematic diagram of the structure of the key distribution device provided in the embodiment of the present application Figure 2 ,like Fig. 9 As shown, the device may include:

[0156] The receiving module 601 is used to receive key data sent by the central key management system, where the key data is generated by the central key management system according to the key to be distributed and the distribution key protection key of the key management system of any region, and the distribution key protection key has the same length as the key to be distributed;

[0157] A decryption module 602, used to decrypt the key data according to the distribution key protection key to obtain the key to be distributed;

[0158] An encryption module 603 is used to encrypt the key to be distributed using a preset post-quantum encryption algorithm to obtain an encrypted ciphertext;

[0159] The second sending module 604 is used to send the encrypted ciphertext to multiple devices respectively, so that the multiple devices can decrypt the encrypted ciphertext respectively to obtain the key to be distributed.

[0160] Optionally, the encryption module 603 is specifically used to obtain the post-quantum public keys of multiple devices; encrypt the keys to be distributed according to the post-quantum public keys of the multiple devices respectively to obtain multiple encrypted ciphertexts, and each device decrypts the encrypted ciphertext according to the post-quantum private key corresponding to the post-quantum public key to obtain the keys to be distributed.

[0161] Optionally, the encryption module 603 is specifically configured to generate a symmetric key ciphertext of a symmetric key according to the post-quantum public key of each device; encrypt the key to be distributed according to the symmetric key of each device to obtain an encrypted ciphertext;

[0162] The second sending module 604 is specifically used to send encrypted ciphertext and symmetric key ciphertext to multiple devices respectively, so that each device decrypts the symmetric key ciphertext according to the post-quantum private key to obtain the symmetric key, and then decrypts the encrypted ciphertext according to the symmetric key to obtain the key to be distributed.

[0163] Optionally, the key management system of each area includes: a key forwarding module and a second quantum key distribution module, and the device may also include:

[0164] The negotiation module is used to negotiate with the first quantum key distribution module of the central key management system through the second quantum key distribution module according to the quantum key distribution protocol to determine a distribution key protection key with the same length as the key to be distributed; and send the distribution key protection key to the key forwarding module through the second quantum key distribution module.

[0165] The above-mentioned device is used to execute the method provided by the aforementioned embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0166] The above modules may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASICs), or one or more microprocessors, or one or more field programmable gate arrays (FPGAs). For another example, when a module is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these modules may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0167] Fig.10 A schematic diagram of an electronic device provided in an embodiment of the present application, such as Fig.10 As shown, the electronic device 700 includes: a processor 701, a storage medium 702 and a bus, the storage medium 702 stores program instructions executable by the processor 701, when the electronic device 700 is running, the processor 701 and the storage medium 702 communicate through the bus, and the processor 701 executes the program instructions to execute the above method embodiment. The specific implementation method and technical effect are similar and will not be repeated here.

[0168] Optionally, the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the above method embodiment is executed.

[0169] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0170] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0171] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0172] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English: Read-Only Memory, abbreviated: ROM), random access memory (English: Random Access Memory, abbreviated: RAM), disk or optical disk and other media that can store program codes.

[0173] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A key distribution method, characterized in that: Applied to a central key management system, the central key management system communicates with key management systems of multiple regions, and the key management system of each region communicates with key receiving systems of multiple devices in each region, the method comprising: Generate a key with random length to be distributed; Acquire multiple distribution key protection keys corresponding to the key management systems of the multiple regions respectively, wherein the multiple distribution key protection keys have the same length as the key to be distributed; Generate multiple key data according to the key to be distributed and the multiple distribution key protection keys; The corresponding key data are respectively sent to the key management systems of the multiple areas, so that the management system of each area decrypts the corresponding key data according to the distribution key protection key to obtain the key to be distributed, and uses a post-quantum encryption algorithm to encrypt the key to be distributed and then sends it to the key receiving system of multiple devices in each area.

2. The method according to claim 1, characterized in that The step of generating a plurality of key data according to the key to be distributed and the plurality of distribution key protection keys comprises: An exclusive OR operation is performed on the key to be distributed and the multiple distribution key protection keys to generate the multiple key data.

3. The method according to claim 1, characterized in that The central key management system includes: a key distribution module and a first quantum key distribution module, and the obtaining of a plurality of distribution key protection keys corresponding to the key management systems of the plurality of regions respectively includes: According to a quantum key distribution protocol, the first quantum key distribution module negotiates with the second quantum key distribution modules of the key management systems of the multiple regions respectively to determine a distribution key protection key with the same length as the key to be distributed; Sending the distribution key protection key to the key distribution module through the first quantum key distribution module; The step of generating a plurality of key data according to the key to be distributed and the plurality of distribution key protection keys comprises: Generate the multiple key data according to the key to be distributed and the multiple distribution key protection keys by the key distribution module; The sending corresponding key data to the key management systems of the multiple regions respectively includes: The key distribution module sends corresponding key data to the key forwarding modules of the key management systems of the multiple areas respectively.

4. A key distribution method, characterized in that: A key management system applied to any area, the key management system of any area communicates with a central key management system, and the key management system of any area also communicates with key receiving systems of multiple devices in the any area, the method comprising: Receiving key data sent by the central key management system, wherein the key data is generated by the central key management system according to the key to be distributed and the distribution key protection key of the key management system of any region, and the distribution key protection key has the same length as the key to be distributed; Decrypting the key data according to the distribution key protection key to obtain the key to be distributed; Encrypting the key to be distributed using a preset post-quantum encryption algorithm to obtain an encrypted ciphertext; The encrypted ciphertext is sent to the multiple devices respectively, so that the multiple devices decrypt the encrypted ciphertext respectively to obtain the key to be distributed.

5. The method according to claim 4, characterized in that The method of encrypting the key to be distributed by using a preset post-quantum encryption algorithm to obtain an encrypted ciphertext includes: Obtaining post-quantum public keys of the multiple devices; The keys to be distributed are encrypted respectively according to the post-quantum public keys of the multiple devices to obtain multiple encrypted ciphertexts, and each device decrypts the encrypted ciphertexts according to the post-quantum private key corresponding to the post-quantum public key to obtain the keys to be distributed.

6. The method according to claim 5, characterized in that The method of encrypting the keys to be distributed according to the post-quantum public keys of the multiple devices to obtain multiple encrypted ciphertexts includes: Generate a symmetric key ciphertext of a symmetric key according to the post-quantum public key of each device; Encrypting the key to be distributed according to the symmetric key of each device to obtain the encrypted ciphertext; The sending corresponding encrypted ciphertexts to the multiple devices respectively includes: The encrypted ciphertext and the symmetric key ciphertext are sent to the multiple devices respectively, so that each device decrypts the symmetric key ciphertext according to the post-quantum private key to obtain the symmetric key, and then decrypts the encrypted ciphertext according to the symmetric key to obtain the key to be distributed.

7. The method according to claim 4, characterized in that The key management system of any area includes: a key forwarding module and a second quantum key distribution module. Before receiving the key data sent by the central key management system, the method further includes: According to the quantum key distribution protocol, the second quantum key distribution module negotiates with the first quantum key distribution module of the central key management system to determine a distribution key protection key with the same length as the key to be distributed; The distribution key protection key is sent to the key forwarding module through the second quantum key distribution module.

8. A key distribution system, characterized in that: The key distribution system includes: a central key management system, key management systems for multiple regions, and key receiving systems for multiple devices in each region; The central key management system communicates with the key management systems of the multiple regions respectively to execute the key distribution method according to any one of claims 1 to 3 above and distribute keys to the key management systems of the multiple regions; The key management system of each area communicates with the key receiving systems of the multiple devices in each area respectively, so as to execute the key distribution method according to any one of claims 4 to 7 above, and distribute keys to the multiple devices.

9. The key distribution system according to claim 8, characterized in that: The central key management system includes: a key distribution module and a first quantum key distribution module, the key management system of each area includes: a key forwarding module and a second quantum key distribution module, and the key receiving system of each device includes: a key receiving and storage module; The first quantum key distribution module and the second quantum key distribution module negotiate and distribute a key protection key through a quantum channel; The key distribution module sends key data of the key to be distributed to the key forwarding module through a classic channel; The key forwarding module decrypts the key data to obtain the key to be distributed, and sends the encrypted ciphertext corresponding to the key to be distributed to the key receiving and storage module; The key receiving and storage module decrypts the encrypted ciphertext, obtains the key to be distributed and stores it persistently.

10. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores program instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium via the bus, and the processor executes the program instructions to execute the steps of the key distribution method as described in any one of claims 1 to 3, or executes the steps of the key distribution method as described in any one of claims 4 to 7.

Images